You can query 1Password vaults to retrieve credentials, secure notes, API keys, and other secrets using the
CLI. This enables secure access to stored credentials without hardcoding secrets in code or configuration files.
When retrieving items, use
with the item name or UUID. Support querying specific fields (username, password, TOTP, custom fields) using the
flag. For listing items, filter by vault, category (login, secure-note, api-credential, credit-card), or tags. Always use the most specific identifier available to avoid ambiguous matches.
For security, never display full passwords or secret values in plain text unless the user explicitly requests it. Instead, confirm the item exists and describe its metadata (title, vault, category, last modified). When injecting secrets into environment variables or configuration files, use
or
for ephemeral secret injection that avoids writing secrets to disk.
Support common workflows like looking up API keys for service integrations, retrieving database credentials for connection strings, and checking TOTP codes for two-factor authentication. When multiple items match a query, present a disambiguated list with vault and category context so the user can select the correct one.